The remote host is affected by the vulnerability described in GLSA-201310-05 (GEGL: User-assisted execution of arbitrary code)

    Multiple integer overflows in GEGL may cause a heap-based buffer       overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted PPM       image using an application linked against GEGL, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update contains the following changes :

  - Fix buffer overflow in and add plausibility checks to     the ppm-load operation.

    - Fix multi-lib issue where content of generated       documentation could differ between architectures.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated gegl packages fix security vulnerability :

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the gegl utility processed .ppm (Portable Pixel Map) image files. An attacker could create a specially crafted .ppm file that, when opened in gegl, would cause gegl to crash or, potentially, execute arbitrary code (CVE-2012-4433).

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-1027:01 advisory.

    EGL (Generic Graphics Library) is a graph based image processing framework. GEGLs original design was made     to scratch GIMPs itches for a new compositing and processing core. This core is being designed to have     minimal dependencies. and a simple well defined API.
    Security issues fixed with this release:
     CVE-2012-4433     Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0     allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code     via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image, which triggers a heap-based     buffer overflow.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gegl fixes the following issues: Security issue fixed :

  - Fix CVE-2012-4433: Fix buffer overflow in and add     plausibility checks to ppm-load op (bsc#789835).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix integer overflow by parsing PPM image. (bnc#789835, CVE-2012-4433)

ID	名稱	產品	系列	已發布	已更新	嚴重性
70311	GLSA-201310-05 : GEGL: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2013/10/7	2021/1/6	high
67337	Fedora 18 : gegl-0.2.0-11.fc18 (2013-12108)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	high
66095	Mandriva Linux Security Advisory : gegl (MDVSA-2013:081)	Nessus	Mandriva Local Security Checks	2013/4/20	2021/1/6	high
67335	Fedora 17 : gegl-0.2.0-11.fc17 (2013-12075)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	high
67338	Fedora 19 : gegl-0.2.0-11.fc19 (2013-12115)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	high
283945	MiracleLinux 4 : gegl-0.1.2-4.AXS4 (AXSA:2012-1027:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
97773	SUSE SLED12 Security Update : gegl (SUSE-SU-2017:0696-1)	Nessus	SuSE Local Security Checks	2017/3/16	2025/12/30	high
74835	openSUSE Security Update : gegl (openSUSE-SU-2012:1627-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

偵測

搜尋 Plugin

high

high

high

high

high

critical

high

high